fix architecture and write new tests

apps/dashboard/src/middleware.ts

@@ -4,6 +4,12 @@ import type { NextRequest } from 'next/server'
 const PUBLIC_DASHBOARD_PREFIXES = ['/dashboard/sign-in', '/dashboard/forgot-password']
 const MARKETPLACE_URL = process.env.NEXT_PUBLIC_MARKETPLACE_URL ?? 'http://localhost:3000'
 
+
+function rejectInternalSubrequest(req: NextRequest): NextResponse | null {
+  if (!req.headers.has('x-middleware-subrequest')) return null
+  return new NextResponse('Unsupported internal request header', { status: 400 })
+}
+
 function dedupeDashboardPath(pathname: string): string {
   return pathname.replace(/^\/dashboard\/dashboard(?=\/|$)/, '/dashboard')
 }
@@ -21,7 +27,7 @@ function isProtectedRoute(req: NextRequest) {
 }
 
 function localJwtMiddleware(req: NextRequest): NextResponse {
-  const token = req.cookies.get('employee_token')?.value
+  const token = req.cookies.get('employee_session')?.value
   if (token && req.nextUrl.pathname === '/dashboard/sign-in') {
     const dashboardUrl = req.nextUrl.clone()
     dashboardUrl.pathname = '/dashboard'
@@ -54,6 +60,9 @@ function localJwtMiddleware(req: NextRequest): NextResponse {
 }
 
 export default function middleware(req: NextRequest) {
+  const rejected = rejectInternalSubrequest(req)
+  if (rejected) return rejected
+
   const dedupedPath = dedupeDashboardPath(req.nextUrl.pathname)
   if (dedupedPath !== req.nextUrl.pathname) {
     const redirectUrl = req.nextUrl.clone()